Security

What this page is

This describes the security posture of this website only — not of any system Peakure builds for a client. Client engagements carry their own written terms, and the controls there are specified per project.

What this site stores

Nothing. There is no account system, no login, and no database behind peakure.com. The site is statically generated and served over HTTPS.

The one exception is the contact form. A submission is delivered to us as email and is not written to any store on this site. The submitting IP address is held in memory for about a minute to rate-limit repeat sending, and is never persisted to disk.

This site sets no analytics or advertising cookies and runs no third-party tracking scripts.

Subprocessors

These are the third parties that can touch information sent through this site:

• Vercel — hosting and delivery. Processes request metadata such as IP address and user agent.
• Resend — delivers contact-form submissions as email.
• Google Workspace — hosts the mert@peakure.com mailbox where those messages arrive.
• Cal.com — scheduling, if you book a call. Receives the name, email and any notes you enter there.

Your data rights

You can ask what we hold about you, ask for a copy, ask for it to be corrected, or ask for it to be deleted. Because the only thing this site produces is email, deletion means deleting the correspondence.

Email mert@peakure.com and say what you want. We do not require a specific form of words, and we do not charge for a request.

Reporting a vulnerability

Email mert@peakure.com. Machine-readable contact is at /.well-known/security.txt.

We do not run a paid bug-bounty programme. We will acknowledge a genuine report and tell you when it is fixed.

What this page does not claim

Peakure holds no third-party security certification. We are not SOC 2, ISO 27001, HIPAA or PCI certified, and this site has not been penetration-tested. Stating that plainly is more useful to a buyer than a badge we have not earned.